Mikrotik.moscow [тема: Проблема с IPSEC, mt <> cisco]

Проблема с IPSEC, mt <> cisco

Thu, 04 May 2006 10:51:00 -0400

Проблема с IPSEC, mt <> cisco RouterOS в форуме RouterOS.
Вот конфигурация Cisco, которую нам прислали:

Object-group network Amercom_Network Network=object 10.36.0.0 255.255.0.0
Object-group network SQL_server Description IPs of the same NIC
Network-object host 172.16.54.147
Network-object host 172.16.54.148
Access-list vpn-amercom extended permit ip object-group SQL_server object-group Amercom_network
Crypto ipsec transform-set AMERCOM esp-3des esp-sha-hmac
Crypto map SARALEE-MAP 10 match address vpn-Amercom
Crypto map SARALEE-MAP 10 set peer 62.x.y.z
Crypto map SARALEE-MAP 10 set transform-set Amercom
Crypto map SARALEE-MAP 10 set security-association lifetime seconds 86400
Crypto map SARALEE-MAP 10 set nat-t disable
Crypto map SARALEE-MAP interface outside
Isakmp enable outside
Isakmp policy 1 authentication pre-share
Isakmp policy 1 encryption 3des
Isakmp policy 1 hash sha
Isakmp policy 1 group 2
Isakmp policy 1 lifetime 86400
Tunnel-group 62.x.y.z type ipsec-121
Tunnel-group 62.x.y.z ipsec-attributes Pre-shared-key *
04.05.2006 10:51:00, rexie.

Проблема с IPSEC, mt <> cisco

Thu, 04 May 2006 10:47:00 -0400

Проблема с IPSEC, mt <> cisco RouterOS в форуме RouterOS.
Можешь, пожалуйста, выложить конфиг Cisco, чтобы можно было сравнить. С уважением, Faton.
04.05.2006 10:47:00, fatonk.

Проблема с IPSEC, mt <> cisco

Thu, 04 May 2006 08:32:00 -0400

Проблема с IPSEC, mt <> cisco RouterOS в форуме RouterOS.
Привет, я пытаюсь настроить ipsec-туннель между нашим Mikrotik и Cisco (модель неизвестна) клиента. По какой-то причине мы не можем пройти этап 1. У кого-нибудь есть какие-нибудь подсказки или примеры настройки этого соединения?

Конфигурация:

policy:
0
src-address=10.36.0.0/16:any
dst-address=172.16.54.147/32:any
protocol=all
action=encrypt
level=require
ipsec-protocols=esp
tunnel=yes
sa-src-address=62.x.y.z
sa-dst-address=217.x.y.z
proposal=BT
manual-sa=none
dont-fragment=clear

peer:
0
address=217.x.y.z/32:500
secret=“*****”
generate-policy=no
exchange-mode=main
send-initial-contact=no
proposal-check=claim
hash-algorithm=sha1
enc-algorithm=3des
dh-group=modp1024
lifetime=1d
lifebytes=0

proposal:
1
name=“BT”
auth-algorithms=sha1
enc-algorithms=3des
lifetime=1d
lifebytes=0
pfs-group=none

log:
10:21:51 ipsec,ike,info queuing SA request, phase 1 with peer 217.x.y.z will be established first
10:21:51 ipsec,ike,info initiating phase 1, starting mode Identity Protection (local 62.x.y.z:500) (remote unknown)
10:21:51 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:51 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info packet has invalid ID payload (remote unknown)
10:21:52 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:53 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:54 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:55 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:22:02 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:09 system,info,account user admin logged out from 10.36.0.27 via telnet
10:22:12 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info dequeuing SA request to 217.x.y.z, phase 1 wait timed out
10:22:32 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 2, Informational
10:22:33 ipsec,ike,info phase 1 deleted (local 62.x.y.z:500) (remote 217.x.y.z:500)

Привет, Рекс
04.05.2006 08:32:00, rexie.